CVE-2025-64134_CVE-2025-64134

7.1 / 10

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Description

Jenkins JDepend Plugin 1.3.1 and earlier includes an outdated version of JDepend Maven Plugin that does not configure its XML parser to prevent XML external entity (XXE) attacks.

Basic Information

ID CVE-2025-64134

Source jenkins

Published Oct 29, 2025 at 13:29

Modified Oct 29, 2025 at 14:08

Affected Product

Vendor Jenkins Project

Product Jenkins JDepend Plugin

Affected Versions Jenkins Project Jenkins JDepend Plugin 0

CWE Classification

CWE-611

References

www.jenkins.io /security/advisory/2025-10-29/

{
    "lastseen": "",
    "description": "Jenkins JDepend Plugin 1.3.1 and earlier includes an outdated version of JDepend Maven Plugin that does not configure its XML parser to prevent XML external entity (XXE) attacks.",
    "published": "2025-10-29T13:29:41.699Z",
    "modified": "2025-10-29T14:08:30.966Z",
    "type": "cve",
    "title": "CVE-2025-64134",
    "source": "jenkins",
    "references": "https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-2936",
    "id": "CVE-2025-64134",
    "bulletinFamily": "",
    "cwe": [
        "CWE-611"
    ],
    "cvelist": null,
    "sourceData": "Jenkins Project Jenkins JDepend Plugin 0",
    "sourceHref": "",
    "cvss": {
        "score": 7.1,
        "severity": "HIGH",
        "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
        "version": "3.1"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "Jenkins JDepend Plugin",
    "version": "0",
    "vendor": "Jenkins Project",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}